1. InfoconDB
  2. Black Hat
  3. Black Hat USA 2013
  4. PDF Attack: A Journey from the Exploit Kit to the Shellcode

PDF Attack: A Journey from the Exploit Kit to the Shellcode

Presented at Black Hat USA 2013, July 31, 2013, 3:30 p.m. (60 minutes)

PDF Attack: A journey from the Exploit Kit to the shellcode is a workshop to show how to analyze obfuscated Javascript code from an Exploit Kit page, extract the exploits used, and analyze them. Nowadays it is possible to use automated tools to extract URLs and binaries but it is also important to know how to do it manually to not to miss a detail. We will focus on PDF documents mostly, starting from a simple Javascript Hello World document and ending with a real file used by a fresh Exploit Kit. This workshop will also include exercises to modify malicious PDF files and obfuscate them to try to bypass AV software; very useful in pentesting. The latest version of peepdf (included in REMnux, BackTrack and Kali Linux) will be used to accomplish these tasks, so this presentation covers the latest tricks used by cybercriminals like using new filters and encryption to make analysis more difficult.


Presenters:

  • Jose Miguel Esparza - Fox-IT
    Jose Miguel Esparza is a security researcher who has been working as an e-crime analyst for more than 6 years, focused on botnets, malware, and Internet fraud. During the last few years he worked at S21sec e-crime, but recently joined the Fox-IT Cybercrime team in The Netherlands. Author of some exploits and analysis tools like Malybuzz and peepdf (http://peepdf.eternal-todo.com). He is also a regular writer on eternal-todo.com (http://eternal-todo.com) about security and threats in Internet, and has taken part in several conferences, e.g. RootedCon (Spain), NcN (Spain), CARO Workshop (Czech Republic), Source Seattle (USA) and Black Hat (The Netherlands / USA). You can easily find him on Twitter @EternalTodo talking about security.

Links:

Similar Presentations: